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1.0 INTRODUCTION . The NASA Headquarters SPAR document NHB 1/00.7 (Safety Policy and 

Requirements for Payloads Using the Space Transportation Syscem), establishes both 
technical and system safety requirements applicable to a’ 1 STS (space transportation 
system) payloads. It is equally applicable to all payload hardware Including new 
design, existing design (reflown hardware) , and hardware designed primarily for 
coninerclal use. The Implementation Procedure for STS Payloads System Safety 

Requirements has been developed to assist the payload organization in implementing 
the system safety requirements identified in the SPAR document. 

The implementation task is a joint responsibility of the payload organi zation , the 
flight operator (JSC), and the launch/ landing site operator (KSC). The implementa- 
tion procedures for single element type payloads and experiment payloads (such as 
Spacelab experiments and pallets or other types of carriers involving a group of 
individual experiments) are different and will be addressed separately in sections 

5.0 and 7.0, respectively. If, however, individual experiments are integrated into 
the STS as a singular entity, they are classified as payloads and will be treated in 
*he same manner as a single element type payload. 

Payload organizations are responsible for assuring that payload systems, including 
GSE (ground support equipment), comply with NASA safety requirements, and in doinq 
so, are required to perform a safety analysis and submit a safety assessment report 
on each STS payload for qround and flight operations. The safety analysis begins 
during the payload concept phase and is refined and expanded as the payload design 
matures. The safety analysis results are recorded on the safety matrix, hazard list, 
and hazard report forms and presented to the safety review panel as described in this 
document. This process fulfills the NASA requirement for a hazard analysis and 
safety assessment report. 

2.0 PURPOSE . The purpose of this document is to provide guidelines and instructions 
for tKe implemeni-at ion of *he SPAR system safety requirements applicable to STS 
payloads. 

3.0 SCOPE . This document describes the initial contact meeting with the payload 
organi zat ion and defines the subsequent safety reviews necessary to comply with the 
system safety requirements of the SPAR document. Waiver instructions are included 
for the cases in which a safety requirement cannot be met. 

The launch/landing site content of this document is limited to ground operations at 
KSC* Implementation of the Vandenberg Air Force Base launch/landing site STS payload 
safety requirements will be addressed in a future update of this document when that 
1at.nch/landing site becomes operational. 

4.0 INITIAL CONTACT MEETING . An informal initial contact meeting will be held at 
the earliest appropriate time prior to the phased safety reviews. The payload orga- 
nization will notify the Manager, STS Operations Office, code PF, JSC, to establish 
the initial contact meeting. During this meetinq, the payload organization will be 
briefed by the flight operator and the launch/landing site operator. Included in the 
briefing will be an overview of the technical and system safety requirements to be 
met by the payload organization, plus instructions for the conduct of the safety 
reviews. The payload organization will be provided with the documents and forms 
necessary for developing the safety assessment report. The payload organization will 
be asked to provide a schedule of payload milestones and to request a phase 0 safety 
review when the payload design concept has been developed. 
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5.0 SAFETY REVIEWS . Payload safety review panels have been established by JSC and 
KSC to assist the flight operator, who has prime responsibility for payload design 
and flight operations safety, and the launch/ landing site operator who has prime 
responsibility for GSE design and ground operations safety. The panels are staffed 
by the appropriate technical disciplines and are responsible for conducting the 
phased safety reviews. It is intended that the reviews cover all aspects of safety 
in payload design, flight operations, GSE design, and ground operations to assure 
compliance with the STS safety requi roments . 

For convenience of the payload organization, it is NASA policy to be flexible with 
the timing and location of the safety reviews. For example, at the option of the 
payload organization, the GSC design and ground operations safety reviews may be held 
back-to-back with the nayload design and flight operations safety reviews at JSC or 
they may be conducted >parately at KSC. However, separate reviews at KSC may be 
necessary because of STS .ravel and manpower constraints. The timing and location of 
the GSE design and ground operations safety reviews must be coordinated by the pay- 
load organization with the KSC Cargo Projects Office, Code CP, Kennedy Space Center, 
Florida 32899. 

The safety reviews may be conducted at four levels of design maturity: Phase 0 

through phase III. The phase 0 safety review will normally be an informal review 
chaired by a JSC Safety representati ve for payload design and flight operation and a 
KSC Safety representive for GSE design and ground operations. The phase I through 
phase III safety reviews are formal reviews conducted by the safety review panels. 
Ourinq the formal reviews, the payload organization should be prepared to give a 
presentation which Includes a brief description of the payload and its operation, 
followed by data unique to the phase being reviewed. 

The depth and number of the formal reviews are determined by the safety review panel 
chairman in conjunction with the payload organization and are dependent on the com- 
plexity, technical maturity, and hazard potential of the payload. 

The tintinq and objectives of the safety reviews are listed below: 

PHASE TIME OBJECTIVES 

0 Concept Identify safety-critical subsystems, groups, 

hazards, and applicable safety requirements 
for subsystems ano associated ground opera- 
tions. 


I 

Prel im inary Design 
Rev iew 

Assess the implementation approach, review 
hazards and resolution, and develop an under- 
standing of verification approach. 

II 

Critical Design 
Review 

Verify design compliance with requirements, 
review verification methods. 

III 

Delivery to 
Customer 

Validate the incorporation of previous safety 
review agreements, assure the satisfactory 
completion of safety verification activities. 


provide agreement that safety activities have 
been satisfactorily completed. 


2 



Data that will be presented at the phase 0 through phase III safety review meetings 
shall be submitted by the oayload organization to the Manager, STS Operations Office, 
code PF, Johnson Space Center, Houston, Texas 770S8, for flight and to Chief, Safety 
Operations Office, code SF-SOO, Kennedy Space Center, Florida 32899, for GSE and 
ground operations. The safety review meetings will be scheduled 30 days after 
receipt of the data. A copy of each original approved and signed hazard report 
should be included with the data submitted; however, the original of each completed 
hazard report must be available to the safety review panel chairman for his signature 
at the time of each review. The payload organization is responsible for retaining and 
maintaining the original hazard reports. 

5.1 PHASE 0 SAFETY REVIEW . During the concept phase of the payload and GSE 
development, a preliminary system-level safety analysis is performed by the payload 
organization to determine hazard groups associated with payload subsystem elements 
and to identify hazards. The results of this analysis are docimented by the payload 
organization on a safety matrix (JSC Form 542) and a hazard list (JSC Form 542A). 
Instructions for completion of the safety matrix and hazard list are shown in figures 
1 and 2, respectively. 

For a single element type payload, one matrix and one or more pages listing the 
titles of hazards will suffice. 

The following data are required for a phase 0 safety review: 

a. Payload description and operation. 

b. Hardware description of safety critical subsystems (existing level, new and 
reflown) . 


c. Payload safety matrix. 

d. Hazard list. 

The payload description and operation should be of sufficient detail to permit 
identification of all subsystems, with emphasi: on stored energy, which have 

potential for creating hazards. 

During the phase 0 safety review the payload organization should address tentative 
plans for any operation that would require personnel training and cert i f icat ion for 
hazardous procedures including both fliqht and ground operations. 

5.2 PHASE I SAFETY REVIEW . During the early design phasp, the safety analysis is 
refined and expanded by evaluating each hazard for means of eliminating, reducing, or 
controlling the hazard and by identifying the approach for verifying compliance with 
the safety requirements. The results of this effort are documented on a hazard report 
form (JSC Form 542B). Instructions for completion of the hazard report are shown in 
figure 3. 

To aid the payload organization in performing the hazard analysis, a sample schematic 
of a safety-critical subsystem along with examples of a completed safety matrix, 
hazard list, and hazard report are shown in figures 4 through 7, respectively. 
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For the single element type payload and Its associated GSE, one hazard report for 
each hazard Is required. For reflown hardware, existing analyses should be reviewed 
to determine If the SPAR requirements have been met. If no deficiencies exist, the 
analyses may be summarized on one hazard report form. 

Each hazard report should stand alone; therefore, It must be supported by data such 
as block diagrams, schematics, a description of safety-critical subsystems and their 
operations, and nonmetal 11c material and radioactive source Information. The block 
diagram or preliminary schematic should Indicate the design approach which Is 
Intended to control the Identified hazard. Partial diagrams and schematics are 
satisfactory provided the element for hazard control Is Identified. 

The radioactive source quest lonnaire (JSC Form 44) shall be completed at the time of 
the phase I safety review. The data provided on this form will suffice for Initial 
information transfer of radioactive source data required by both JSC and KSC. An 
example of a completed radioactive source questionnaire is shown In flnure 8. The 
need for additional Information will be based on the source, the quantity, and the 
proposed method of usage. The details associated with handling of radioactive 
material at the laurich/landing site will be negotiated at the ground operations and 
GSE phase 0 safety review. Consideration shall also be given to constraints on the 
receipt, use, and transfer of materials as authorized by the Nuclear Regulatory 
Commission. 

Preliminary materials safety assessments (addressing fl amrnabi 1 i*y, offgassing, and 
materials cumpatabi 1 1 ty with hazardous fluids as applicable) should be conducted for 
the phase I safety review and documented on payload hazard reports. If detail 
materials information Is required to support these reports, the data should be 
submitted on a Payload Materials Usage List, JSC Form 5420 (Figure 9). 

The following data, which must be submitted 30 days in advance, are required for the 
formal presentation at the phase 1 safety review: 

a. Block diagrams, schematics, and/or a description of safety-critical 
subsystems and their operations. 

b. Hazard reports. 

c. Payload assembly and checkout operations to be conducted at KSC, with 
prel imi na r ) timelines. 

o. Radioactive source questionnaire. 

5.3 PHASE II SAFETY REVIEW . As the payload and GSE design is completed and refined, 
the safety anal ysis Ts further updated and expanded. The original signed hazard 
reports completed at phase I are updated to Include additional data on control of the 
hazard causes and safety verification methods. 

The following data are required for a phase 11 safety review: 

a. Safety-critical subsystem descriptions (update). 

b. Engineering drawings of safety-critical subsystems when specifically 
requested. 
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c. Payload assembly and checkout operations to be conducted at KSC (update). 

d. A list of safety-related failures or accidents. 

e. A list of technical operating procedures related to Identified hazard 
controls and date of availability for review. 

f. Updated hazard reports and support data including the following: 

(1) A list of equipment qeneratlnq hazardous radiation. 

(2) Radioactive source questionnaire (update). 

5.4 PHASE 111 SAFETY REVIEW . The safety analysis is completed at the time of the 
phase III safety review. The hazard reports cr.npleted at phase II are updated and 
submitted for final approval. All the safety compliance data requi-od by the SPAR 
document are submitted for review at this time. The official submittal of the safety 
compliance data will precede the hardware delivery by 30 days. The safety assessment 
report, which is part of the safety compliance data, Includes the completed hazard 
reports and the identification of any open safety Items. 

The following data are required for a phase III safety review: 

a. Updates of safety-critical subsystems descriptions. 

b. Updates of safety-critical subsystem engineering drawings when specifically 
requested. 

c. Results of applicable safety verification tests and analyses. 

d. Safety compliance data as defined in the SPAR docunent. 

All open items are tracked and closeout is formally documented in correspondence with 
the payload organi zat ion. The final safety status of the payload will be presented 
to the Flight. Readiness Review Board. 

5.0 WAIVERS . When a specific safety requirement cannot be met, a completed waiver 
request, JSC Form 542C (figure 10) shall be submitted by the payload organization to 
the Manager, STS Operations Office, code PF, JSC, for flight. Waiver requests for 
GSE ard ground operations shall be submitted to the Director, Safety, RAQA, A 
Protective Service, code SF, Kennedy Space Center, Florida 32899. All waiver 
requests should be coordinated with the appropriate NASA Center prior to submittal 
and should be formally submitted as soon as it is determined that a safety 
requirement cannot be met. Each waiver request will address only one hazard or 
hazard cause. After initial coordination, the waiver request will be formally 
submitted for approval. The payload organization will be formally notified of the 
acceptance or rejection of the waiver request. Approval n f the waiver request will 
not relieve the payload organization of the responsibility of meeting the waiver 
requirement in all ether areas of design and operation of the payload. 

7.0 EXPERIMENT PAYLOADS . This section defines the variances to the basic procedures 
of section 5.0 for conducting experiment payloads flight operator safety reviews. 
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Experiment payloads are defined as assemblies of experiments mounted and/or operated 
on or within a dedicated carrier structure and/or the Orb. ter. The carrier structure 
will be considered as part of the experiment payload, unless excluded by prior 
aqreement with the STS Operator. 

This section does not alter the procedures for conducting the launch/landing site 
operator safety reviews as defined in section 5.0. If similar procedures to those 
defined herein are requested for GSE design and ground operations safety reviews, 
*hey should be coordinated with the KSC Cargo Projects Office. 

7.1 PAVLOAO ORGANIZATION . The payload mission manager shall be designated as the 
payload organization for experiment payloads. However, when individual experiments 
are developed without a specific experiment payload assignment, the single point of 
contact for STS payloads system safety at the applicable NASA Center shall assume the 
safety tasks of the payload orgainzation until the experiment is assigned. 

7.2 I NO I VI DUAL EXPERIMENT DATA SUBMITTALS . Safety data on individual experiments 

may be submitted in advance for TTTgFt operator acceptance apart from the formal 
payload safety reviews. In addition the data may be submitted by the single point of 
contact for STS payloads system safety prior to the experiment being assigned to a 
•specific experiment payload with a designated mission manager. These advanced 
submittals should contain all the applicable experiment safety data for the le>'el of 
acceptance being requested as defined in this section and in 5.C. The flight 

operator's disposition of these data (concurrence/approval of hazard reports, action 
items, etc.) will be the «ame as if the data were presented at a formal payload 
safety review. The mission manager or the single point of contact for STS payloads 
•ystem safety must schedule all advanced data submittals with the Executive 
Secretary, STS Payloa.i Safety Review Panel, Mail Code NS2, Johnson Space Center, 
Houston, TX 77058. 

7.3 PAYLOAD SAFETY REVIEWS . Formal STS Payload Safety Review Panel meetings on 
experiment payl oads are normally convened only for reviewing the total integrated 
payload (i.e., experiments, applicable carrier structure, and all interfaces). These 
safety reviews should be scheduled whpn all the experiments listed on the manifest 
for a particular mission are at or above the following levels of design maturity: 
phase 0, concept; phase 1, preliminary design; phase II, final design; and phase III, 
delivery. The actual review dates will be 30 days after JSC receives the integrated 
payload safety data submittal. Individual ESP's (experiment safety packages) that 
are signed by the flight operator prior to the payload safety review should be a part 
of the integrated payload safety data submittal. 

7.3.1 PHASE 0 . Since the objective of the phase 0 is to conduct a preliminary 
system leve) safety analysis and to baseline a list of hazards, the phase 0 data 
should include conceptual descriptions of the experiments, operations, interfaces, 
and safety-critical hardware. A safety matrix (JSC Form 542) and a hazard list (JSC 
Form 542A) are required for each individual experiment and for the carrier structure 
(if it is included as part of the experiment payload). 

Since only a conceptual level of design will be available for review, many interface 
hazards may not be definable. Interface hazards for experiment payloads include 
interactions of experiment to experiment, experiment-to-Orbiter/carrier structure, 
and carrier structure to Orbiter (if applicable). If any interface hazards are 
identified and these hazards are not already addressed in the individual experiment 
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hazard lists, a separate matrix and hazard list for Interface hazards should be 
prepared. As the design matures and the Interfaces are better developed, additional 
Interface hazards should be added as required. A complete baseline of Interface 
hazards should be submitted at phase I. 

7.3.2 PH ASE 1 . Hazard reports (JSC Form 542B) are prepared to addn.is each hazard 
identified on the hazard lists for the Individual experiments, the carrier structure 
(If applicable), and the Interfaces. All hazard reports for an individual experiment 
shall be contained In an ESP. An ESP shall Include (1) a signature cover sheet (JSC 
Form 542E); (2) all applicable hazard reports, Including support data; and (3) a list 
of safety review actions. If assigned. Instructions for JSC Form 542E are contained 
In figure 11. Each ESP and each Interface hazard report shall stand alone (l.e., It 
shall contain supporting data similar to that specified In paragraph S.2). 

Phase I safety review concurrence In the ESP's shall be documented by the flight 
operator's signature on the cover sheets at the completion of the phase I safety 
review. The individual hazard reports In the ESP's will not be signed by the flight 
operator. Concurrence In the remaining hazard reports shall bp f he same as defined 
In section 5.0. 

7.3.3 PHASE 1 1 . For the phase II safety review, the original signed phase I ESP's 
and interface hazard reports are updated to Include additional data on the control of 
hazard causes and safety verification methods. Phase II safety review concurrence 
will be documented in the same manner as phase I. 

7.3.4 PHASE III . The Interface hazard reports and the ESP's completed at phase II 
are updato3 and submitted for final approval. The safety assessment rpport shall 
include the completed interface hazard reports and the ESP's. STS operator approval 
signature wi’l be required on each ESP and on each interface hazard '•eport . 
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PAYLOAD SAFETY MATRIX 
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NOTE: Hazard qroups and subsystems are defined 

and described In JSC 11123, STS Payload Safety 
Guidelines Handbook. The subsystems list may be 
expanded or modified for specific payloads/GSE. 

The Intent of this form Is to assist the Payload 
Organization In Identifying hazards associated 
with the payload/GSE. 

INSTRUCTIONS: 

1. For * rinqle element type payload prepare two 
matrixes, one for the payload and anotner for 
GSE/ground operations. For experiment payloads 
prepare matrixes for the foil owl nq: 

a. c ie for each experiment 

b. one for Interface hazards 

c. the carrier structure (If applicable) 

d. GSE/ground operations 

2. Complete blocks for payload/GSE/experlment 
title, payload organization, date, and pane. 

3. Determine safety subsystem elements. 

4. For each identified safety subsystem element, 
check the hazard qroup(s) that could apply. 

This will be based on the particular hardware, 
deslqn, and operation of the subsystem. JSC 
11123 may be used as a quide to determine If 

a hazard group applies. 
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HAZARD LIST 


NI7IR0 GROUP 



HAZARD TITK 


PAvlOAD - Enter title of oavload, or payload GSE. (For experiment oayloads 
enter payload or experiment title as aonllcahle) 

SUBSYSTEM - Enter subsystem chewed on Safety Matrix. 

DATE - Enter date form Is completed or revised. 

HAZARD GROUP - Enter hazard oroup (checked on Safety Matrix) that 
corresoonds to the subsystem above. 

HAZARD TITLE - Enter hazard tltle(s) which Identify the safety concern 
for each hazard oroup listed. Hazards are identified from safety ana.ysls. 

APPLICAPLE SAFETY RFOUIREMEfITS - Enter the SPAR Daraqraoh numbers for the 
technical requirements that are relc fed to each Identified hazard. 

Complete the Hazard List for each subsystem chocked on the Payload Safety 
Matrix. Hazard lists for more than one subsystem may be Included on one 
hazard list form (see figure 6). 

A separate hazard list should be prepa - ed for GSE and ground operations. 
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Describe the hazard and Its effects on the Orblter, other Dayload, the crew, 
and/or ground operations. Define the mission phase(s) when hazard could occur 
(1.e. t ground operations, boost, etc.). 
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Itemize each possible hazard cause. 




For each hazard cause, define the controls designed Into the system to Dreclude 
or minimize the occurrence of the hazard. Preliminary Information nay be pro- 
vided for phase I and more details provided at phase II and III. 
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For phase I, Identify the verification approach (l.e., test, analysis, Inspection, 
etc.). For phase II, Identify the test plan that verifies the effectiveness of the 
hazard control. For phase III, provide the results of the test, analysis, in- 
spection, etc. 
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Hazard Report Is ooen until all verification Is satisfactorily completed. At 
phase I, provide a tentative schedule for completion of the verification task. 
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PAYLOAD HAZARD REPORT 
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RCS Propellant Lines and Tanks - Rupture Durinq Flight or Deployment Operations 
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209-1 Hazardous Materials 208-4 Pressure Vessels 

208-5 Pressurized Linos and 
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Durinq flight and deployment operations, the ABC RCS system ruptures resulting 
In release of shrannel and hydrazine and causing damaqe to the Orhlter and/or 
Injury to the flight crew. 
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1. Material defects, degradation and/or undetected damage. 

2. Overheating of fluid due to malfunction of temperature control system. 

3. Heating and autodetonation of hydrazine vapor due to adiabatic compression 
when the Isolation valves are initially opened. 


C0NT-L5, 

1. The propellant tanks will be designed to an ultimate factor of Safety of 2.5. 

2. All pressurize*! lines and fittings shall be designed with a factor of Safety 
of 4.0. 

3. Utilize approved and controlled procedures for ODerations, transportation, 
handling, and contamination control to preclude system damage. 

4. Redundant thermal control system with automatic overtemnerature cutoff 

_ .ISEfi. madicd shr.et) 


s*rcry \» • :a*i os mitmq" . 


1. Perform a systems analysis and a structural analysis in accordance with 
MIL-STD-1 522. Proof tests and burst tests will be conducted. 

2. Qualification testing of the thermal control system. 

3. Inspection program to assum material defects are identified and proper 
corrective action is taken. 

(see attached sheet) 
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Open. 

1. System design and analysis in progress. 

2. Systems and structural analyses will be completed by November 1981. 

3. Proof and burst testing will be completed by June 1982. 


4. Qualification testing and analyses will be completed by October 1982. 


CONCURRENCE 


Payload Organization 


STS Oprrntor 


PHASE I 


PHASE I I 



APPROVAL 

PHASE III 

Payload 
Organ I zat ion 

STS Op.-rator 


ISC for* 5428 (Feb 70 ) 


Figure 7 
14 


NASA -JSC 


















HAZARD CONTROLS: 


provisions. 

5. Pressure vessel and olumblnq design meets and exceeds the requirements of 
Mil -5TD-1522. 

6. The Isolation valves are pyrotechnic valves and will not he opened 
until ADC Is 200 feet from Orblter. 

7. Inadvertent oneninn of an Isolation valve will require 3 Independent 
failures or operator errors. 

SAFETY VERIFICATION METHODS: 

4. A caution will be added to operational procedures: "Do not ooen 

Isolation valves until ABC Is at least 200 feet from the Orblter." 

5. Ana.ysls will be conducted to verify pressure system will tolerate 
failed "ON" heaters without rupture. 
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SEE ATTACHMENT 1 FOR DETAILED DRAWINGS AND NARRATIVE OF SHIELDING CHARACTERISTICS 
NUCLEONIC GAUGE. 


IV. SOURCE USE DATA 


JSC EXPLMWtNT •.SO PROGRAM: 

Doedata System - Nucleonic gauge for potable water storage tank, 


Source contained in part number JDA 45678-9 
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EXPERIMENT SAFETY PACKAGE COVER SHEET 
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Blocks 1, 2, 3, 4 , 5, 6, 7, and 11 (also 8 and 10 If applicable) should b® 
completed by the Payload Organization. 

Blocks 8, 0, 10, 12 will be completed by the STS Operator after the review, 
cover sheet nao® number 

experiment alphanumeric designation and title 
payload to rhich experiment Is assigmd 
level of review (l.e. I, II or III) 
date prepared 

unique numb®r assigned to the hazard renort 
title of hazard r®nort 

applicable remarks related to the disposition of the hazard report 
(e.g. references to assignee action Items or chanqes to renort 
made by STS Operator or modifications, deletions etc. mad® by the 
payload organization) 

STS Operator disposition of thp hazjrd report (l.e. open, signed, 
disapproved, etc. ) 

General cornents r®lated tc entire ESP (e g. references to related 
interface hazard reports, action items to prepare additional 
hazard reports or upgrade exoerimnt descriptive and/or support 

data. etc. ) 

applicable signature and date 
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